Thanks Rob Parkhill.
It was the Max data length in cf admin.It was set to 64,000 characters by
default. Adjusting that solved the problem.
Robert Harrison
Director of Interactive Services
Austin & Williams
Advertising I Branding I Digital I Direct
125 Kennedy Drive, Suite 100 I H
> I have a select name="stuff" multiple in a form filled with results from a
> query.
> I get the form field value: stuff=selection1,selection5,selection12.
>
> How do I then build a cfquery using the stuff variable in the IN() statement?
Use the quotedValueList funct
Dave... I'm surprised. Wouldn't you think that CFQueryParam would be the better
way?
Where stuff in ()
Steve
-Original Message-
From: Dave Watts [mailto:dwa...@figleaf.com]
Sent: Monday, August 19, 2013 9:42 AM
To: cf-talk
Subject: Re: Using IN() within a cfquery statement
Dave is allowed one weak answer per year... he's waited til August so I say
we give him a break :)
-Mark
-Original Message-
From: DURETTE, STEVEN J [mailto:sd1...@att.com]
Sent: Monday, August 19, 2013 8:46 AM
To: cf-talk
Subject: RE: Using IN() within a cfquery statement
Dave..
> Dave... I'm surprised. Wouldn't you think that CFQueryParam would be the
> better way?
>
> Where stuff in ()
Yes, that would absolutely be a better way, of course! I didn't even
pay attention to the fact that this was in the form scope.
Dave Watts, CTO, Fig Leaf Software
http://www.figleaf.co
I'm going to go print this email out right now. For the next time Dave is
wrong. Sometime in 2019.
On Mon, Aug 19, 2013 at 8:53 AM, Dave Watts wrote:
>
> > Dave... I'm surprised. Wouldn't you think that CFQueryParam would be the
> better way?
> >
> > Where stuff in ( cfsqltype="appropriate typ
x27;s waited til August so I say
> we give him a break :)
>
> -Mark
>
> -Original Message-
> From: DURETTE, STEVEN J [mailto:sd1...@att.com]
> Sent: Monday, August 19, 2013 8:46 AM
> To: cf-talk
> Subject: RE: Using IN() within a cfquery statement
>
>
> Dave...
cf-talk
Subject: Re: Using IN() within a cfquery statement
I take an entirely different viewpoint on Dave's answer. I read the
original post and declined to answer because it seemed pretty obvious that
ZERO effort was put in place by the questioner to find an answer. My bet is
Dave had a simi
-
> > From: DURETTE, STEVEN J [mailto:sd1...@att.com]
> > Sent: Monday, August 19, 2013 8:46 AM
> > To: cf-talk
> > Subject: RE: Using IN() within a cfquery statement
> >
> >
> > Dave... I'm surprised. Wouldn't you think that CFQueryParam wou
> I take an entirely different viewpoint on Dave's answer. I read the
> original post and declined to answer because it seemed pretty obvious that
> ZERO effort was put in place by the questioner to find an answer. My bet is
> Dave had a similar feeling regarding the effort, but instead of declini
I wonder if the problems with cfquickdocs and cfgloss are related to the
switchover of the ColdFusion docs to the new wiki format? Or is that
only for CF10 docs?
-Carl V.
On 8/19/2013 7:15 AM, DURETTE, STEVEN J wrote:
> I know from trying to look something up last week that I couldn't get to
coldfusiondocs.com not working properly either, so seems likely.
On Mon, Aug 19, 2013 at 4:26 PM, Carl Von Stetten
wrote:
>
> I wonder if the problems with cfquickdocs and cfgloss are related to the
> switchover of the ColdFusion docs to the new wiki format? Or is that
> only for CF10 docs?
>
Dave wasn't wrong, he was differently right.
--rt
On 8/19/13 10:08 AM, Raymond Camden wrote:
>
> I'm going to go print this email out right now. For the next time Dave is
> wrong. Sometime in 2019.
~|
Order the Adobe Coldfusion
I like the Mega mind response...
you were right, I was less right
On Wed, Aug 21, 2013 at 5:28 PM, Ron Thigpen wrote:
>
> Dave wasn't wrong, he was differently right.
>
> --rt
>
> On 8/19/13 10:08 AM, Raymond Camden wrote:
> >
> > I'm going to go print this email out right now. For the next t
Ryan Shrout [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, April 26, 2000 12:05 PM
> To: [EMAIL PROTECTED]
> Subject: Desperate With Comparing Dates in CFQUERY
>
>
> This is a multi-part message in MIME format.
>
> --=_NextPart_000_003D_01BFAF91.1A170C20
> Conten
: <[EMAIL PROTECTED]>
Sent: Wednesday, April 26, 2000 7:00 PM
Subject: RE: Desperate With Comparing Dates in CFQUERY
> Ryan,
>
> If the time is not specified in your selection criteria, SQL defaults it
to
> 00:00 midnight. You aren't receiving any results because the none o
> If I have a form and post a value - say required="yes" message=" Please enter FQDN"> to a receiving
> page with a query as:
>
>
> select handle, domain, tld
> from domains
> WHERE domain='#form.domain#'
>
>
> This works however the domain in the form is actually both
> the value in the da
ANY IDEAS ON SYNTAX OR WHAT I AM OVERLOOKING:
The problem is using CFQUERY update to post edited results extracted from a
memo field back to that memo field. TPLT_TXT is a memo field.
I can SELECT data and display in in a textarea fine. It bombs when I try to
put it back. There is data in the
Sorry to talk to myself about this problem, but, it's maddening.
Apparently at least one solution is to trim the length of the string
FORM.TPLT_TXT produced by the textarea to the length of the string in the
textarea before doing the update (go figure) as follows:
UPDATE TEMPLAT1
SET
Save the query in the session scope, ie:
..
Then the query is available from page to page.
DC
- Original Message -
From: "sam sidhom" <[EMAIL PROTECTED]>
To: "CF-Talk" <[EMAIL PROTECTED]>
Sent: Thursday, December 07, 2000 9:41 AM
Subject: pa
Depending on the size of the recordset you could use WDDX to create a packet
and pass that along in a hidden field...
HTH,
John
-Original Message-
From: sam sidhom [mailto:[EMAIL PROTECTED]]
Sent: Thursday, December 07, 2000 8:42 AM
To: CF-Talk
Subject: passing cfquery results to
ssion scope due to the potential for clogging
server memory...)
HTH - if this doesnt quite cover what u need - let me know...
:> -Original Message-
:> From: sam sidhom [mailto:[EMAIL PROTECTED]]
:> Sent: 07 December 2000 14:42
:> To: CF-Talk
:> Subject: passing cfquery res
Cache the query.
best, paul
At 08:41 AM 12/7/00 -0600, you wrote:
>Can anyone tell me if there is anyway CF will pass the results of a
>CFQuery to another page without having to requery the database?
~~
Structure your ColdFusio
Subject: passing cfquery results to another page
Can anyone tell me if there is anyway CF will pass the results of a CFQuery
to another page without having to requery the database?
Thanks,
Jennifer Johnson
~~
Structure your ColdFusion code with
Bob
-Original Message-
From: sam sidhom [mailto:[EMAIL PROTECTED]]
Sent: December 7, 2000 9:42 AM
To: CF-Talk
Subject: passing cfquery results to another page
Can anyone tell me if there is anyway CF will pass the results of a CFQuery
to another page without having to requery the dat
Fax
-Original Message-
From: sam sidhom <[EMAIL PROTECTED]>
To: CF-Talk <[EMAIL PROTECTED]>
Date: Thursday, December 07, 2000 9:59 AM
Subject: passing cfquery results to another page
>Can anyone tell me if there is anyway CF will pass the results of a CFQuery
to another pa
> Can anyone tell me if there is anyway CF will pass the results of
> a CFQuery to another page without having to requery the database?
Several ways you can do this:
Put the query into the Application scope,
Cache the query (you run the query as normal, but it takes no time),
Put the quer
-
From: sam sidhom [mailto:[EMAIL PROTECTED]]
Sent: Thursday, December 07, 2000 8:41 AM
To: CF-Talk
Subject: passing cfquery results to another page
Can anyone tell me if there is anyway CF will pass the results of a CFQuery
to another page without having to requery the database?
Thanks
I had another thought. Just cache the query, and, as long as it doesn't get
bumped out of memory, it will be available on every page without having to
requery the database (you'd still issue the CFQUERY, but it wouldn't need to
hit the database). This will only work if you
TED]]
Sent: Thursday, December 07, 2000 9:19 AM
To: CF-Talk
Subject: RE: passing cfquery results to another page
There are a number of ways, the first two that come to mind are:
1. Store it in a session variable.
2. Convert it to a WDDX packet, then store it in a client or cookie
variable, or pas
December 07, 2000 11:41 AM
To: CF-Talk
Subject: RE: passing cfquery results to another page
Correct me if I'm wrong here, but I didn't think client, form, url, or
cookies variables can hold complex data like a wddx packet. I would suggest
using a session or application variables for
ject: RE: passing cfquery results to another page
>Correct me if I'm wrong here, but I didn't think client, form, url, or
>cookies variables can hold complex data like a wddx packet. I would suggest
>using a session or application variables for these techniques.
>
>Ric
> Correct me if I'm wrong here, but I didn't think client, form,
> url, or cookies variables can hold complex data like a wddx
> packet. I would suggest using a session or application
> variables for these techniques.
No, you can put WDDX into any of those scopes (although you might have other
Sent: December 7, 2000 11:41 AM
To: CF-Talk
Subject: RE: passing cfquery results to another page
Correct me if I'm wrong here, but I didn't think client, form, url, or
cookies variables can hold complex data like a wddx packet. I would suggest
using a session or application vari
"Hayes, David" wrote:
> Another option: you could cache the query so that the requery on the next
> page will pull the cached version. This could certainly cause some
> problems; it will not be appropriate in many situations.
>
I've seen queries go from multiple seconds (huge dataset) down to
-Talk
Subject: FW: passing cfquery results to another page
I had another thought. Just cache the query, and, as long as it doesn't get
bumped out of memory, it will be available on every page without having to
requery the database (you'd still issue the CFQUERY, but it wouldn't
On differece is that you don't need to bother with reading and writing
session variables, or with locking. Query caching is oh so easy.
Bob
-Original Message-
From: Jann VanOver [mailto:[EMAIL PROTECTED]]
Sent: December 21, 2000 5:08 PM
To: CF-Talk
Subject: RE: passing cfquery re
I'm not sure if the query will get bumped if memory is needed.
I thot some postings here suggested worse consequences.
Anyone know the answer?
best, paul
At 08:18 AM 12/22/00 -0500, you wrote:
>How is caching the query different from saving it as a session variable?
>Both are kept in memory, r
I certainly agree. I gave up on storing my database in structures when I
saw how easy query caching was to work with.
best, paul
At 08:18 AM 12/22/00 -0500, you wrote:
>Query caching is oh so easy.
~~
Structure your ColdFusion code wit
> How is caching the query different from saving it as a
> session variable? Both are kept in memory, right? Except
> that the cached one will get bumped if memory is needed?
Query caching is different in several ways.
1. It uses the CFQUERY attributes and the actual SQL statement w
have a relatively simple CF question
>concerning databases and CFQuery. But for the life of me am stumped (4
>hours to put it exactly). I am trying to build a page with a pull down
>select menu of different towns in the state of connecticut. When the user
>selects a town (i.e. Pla
ion
>concerning databases and CFQuery. But for the life of me am stumped (4
>hours to put it exactly). I am trying to build a page with a pull down
>select menu of different towns in the state of connecticut. When the user
>selects a town (i.e. Plainfield, Smallville...ect.), I would li
www.computerms.com
--- C Kong <[EMAIL PROTECTED]> wrote:
>
> ok all you CFMasters.I think i have a
> relatively simple CF question concerning databases
> and CFQuery. But for the life of me am stumped (4
> hours to put it exactly). I am trying to build
> a page with a
All,
I'm doing a query and randomly displaying images from within each record
but records have been removed so I don't have sequential id values.
PROBLEM:
When I run this code sometime I get images, sometimes I get nothing.
Should I be running a different random'izer? 8-) Any ideas?
CODE:
All,
I'm trying to figure out how best to pass a list of comma delimited id
(numeric) values to
another query. I'm having trouble with getting the list of id values to not
have a "," (comma)
after the last value in the output. Any help would be very appreciated.
Should I be using a cfloop ins
Some people call me the gangster of
love."
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Thursday, June 15, 2006 11:21 AM
To: CF-Talk
Subject: CFQuery simple but not working, strange
Hey All,
Argh!
I've stared at this error for 10 minutes and i
UID may be reserved but you can try: [UID] = #URL.dupid#
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
Sent: Thursday, June 15, 2006 11:21 AM
To: CF-Talk
Subject: CFQuery simple but not working, strange
Hey All,
Argh!
I've stared at this error for 10 mi
>>SQLselect * from app_users where UID = 271
Looks like you've got a http://www.contentbox.com/claude/customtags/tagstore.cfm
(Please send any spam to this address: [EMAIL PROTECTED])
Thanks.
~|
Message: http://www.houseof
. net <
[EMAIL PROTECTED]> wrote:
>
> I'm trying to automate some of an application's database maintentance
> tasks via a CF script that will check to see if it's time for a defrag,
> index rebuild, etc. I know that I can put a DBCC statement in a CFQUERY,
> bu
OTECTED]> wrote:
> >
> > I'm trying to automate some of an application's database maintentance
> > tasks via a CF script that will check to see if it's time for a defrag,
> > index rebuild, etc. I know that I can put a DBCC statement in a
> CFQUERY,
> &g
What is the value of #FORM.search#
It must be at least 1 number, or a comma dleimited list of numbers.
Contains requires full-text search and is for text fields.
Snake
-Original Message-
From: Paul Ihrig [mailto:[EMAIL PROTECTED]
Sent: 21 August 2006 21:34
To: CF-Talk
Subject: cfquery
ill match part of the database ID in the search form...
I have NOT tested this... But maybe It can give you some ideas.
...
Ben Nadel
www.bennadel.com
-Original Message-
From: Paul Ihrig [mailto:[EMAIL PROTECTED]
Sent: Monday, August 21, 2006 4:34 PM
To: CF-Talk
Subj
the search field could be a first name, id date, whatever.
i am doing the 0=0 to return all records if nothing is passed.
then will check to see if it numeric, if it is they will be looking up an
ID.
if there is a similar id, return that set..
say our ids have 123456789 charecters.
i just want to
will match part of the database ID in the search form...
>
>
> I have NOT tested this... But maybe It can give you some ideas.
>
>
> .......
> Ben Nadel
> www.bennadel.com
>
>
> -Original Message-
> From: Paul Ihrig [mailto:[EMAIL PROTECTED]
Here is what I am trying to achieve...
var SearchItem = SelectClientNum.selectedItem.data
SELECT BasicInfo.IDID, IDNo, Identity.ID,
(Trim(Identity.LastName)+", "+Trim(Identity.FirstName)+"
"+Trim(Identity.MI)) AS FullName
FROM (BasicInfo
INNER JOIN Identity ON BasicInfo.I
Hello,
I am having problems doing a simple SQL select.
When I enter: SELECT * from TABLE1, I get an error message that the
asterisk is an invalid character. However, if I used dreamweaver to
view data, I get all the columns and records. If I do a select listing
some of the fields it works.
Al
where upper(PositionName) like '%#ucase(TextToSearch)#%'
or you could use lower and lcase
Claremont, Timothy wrote:
>Can someone tell me how to make this:
>
>WHERE PositionName LIKE '%#TextToSearch#%'
>
>Case insensitive, so it matches both upper and lower case instances?
>
>CF7, Win2K3
>
>TIA,
2:05 PM
....To: CF-Talk
Subject: Making CFQUERY Where Clause case insensitive
Can someone tell me how to make this:
WHERE PositionName LIKE '%#TextToSearch#%'
Case insensitive, so it matches both upper and lower case instance
How about something like this:
WHERE upper(PositionName) LIKE
Matt Osbun
Web Developer
Health Systems, International
-Original Message-
From: Claremont, Timothy [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 26, 2005 2:05 PM
To: CF-Talk
Subject: Making CFQUERY Where Clause case
> Can someone tell me how to make this:
>
> WHERE PositionName LIKE '%#TextToSearch#%'
>
> Case insensitive, so it matches both upper and lower case instances?
>
> CF7, Win2K3
>
> TIA,
> Tim
WHERE UCase(PositionName) LIKE '%#UCase(TextToSearch)#%'
Points to note:
-not all DBs are case sensitive i
Couldn't you create a new index with the upper function? Wouldn't that solve
the index 'blow out' issue?
Dave
-Original Message-
From: Bryan Stevenson [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 26, 2005 3:13 PM
To: CF-Talk
Subject: Re: Making CFQUERY Where Cla
[EMAIL PROTECTED] wrote:
> Couldn't you create a new index with the upper function? Wouldn't that solve
> the index 'blow out' issue?
You can, but don't bother. Unanchored LIKE patterns (starting
with a wildcard) aren't good index candidates anyway.
Jochem
Yeah, good point. :)
Dave
-Original Message-
From: Jochem van Dieten [mailto:[EMAIL PROTECTED]
Sent: Tuesday, July 26, 2005 3:24 PM
To: CF-Talk
Subject: Re: Making CFQUERY Where Clause case insensitive
[EMAIL PROTECTED] wrote:
> Couldn't you create a new index with the upper
Is there any way to find the number of rows affected by the last query
when using SQL Server 2000 and a cfquery UPDATE statement? I'm stumped
on this one. Thanks.
--
Damien McKenna - Web Developer - [EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>
The Limu Company - http://www.thelimu
Silly me. I forgot I'm polling Access for this query.
I get this error with Access:
Syntax error. in query expression 'memberthingy_id = Pa_RaM000 SELECT
@@rowcount as AffectedRows'
--
Damien McKenna - Web Developer - [EMAIL PROTECTED]
The Limu Company - http://www.thelimucompany.com/ - 407-80
Help!! This is not going well.
Need to run a query returning all events that happened during the 0405
fiscal year (1 August 2004 - 31 July 2005).
Realdate is the column in the events table storing the eventdate (format:
dd-mmm-) in a date field in Oracle.
Keep getting the error: Variable R
Are you using the null queryparam value, so that when the value you're
passing is blank, you pass an explicit null?
On 10/3/05, Robert Everland III <[EMAIL PROTECTED]> wrote:
>
> I keep getting a Nullpoint error when I am using cfqueryparam to insert or
> update a timestamp in Oracle and the value
What do you mean by null queryparam value? If I do Null="yes" in my queryparam
then it always passes a NULL value.
Bob
~|
Logware (www.logware.us): a new and convenient web-based time tracking
application. Start tracking an
Do it like this:
On 10/3/05, Robert Everland III <[EMAIL PROTECTED]> wrote:
>
> What do you mean by null queryparam value? If I do Null="yes" in my
> queryparam then it always passes a NULL value.
>
>
>
>
> Bob
>
>
~|
Logware
run
some javascript to resubmit the form. Or wrap a
to create a link.
Am I getting close to your question or just rambling? :-)
MIke
On Sat, 19 Mar 2005 11:42:22 -0500, Daniel Kang <[EMAIL PROTECTED]> wrote:
> I have a cfquery below:
>
>
> select
> datepart(mm, DateofR
Mike,
Yes, that is what I am trying to do, but here is the issue.
Let's say #TheCount# (from the cfoutput below) returns 15 (meaning 15
cfquery results).
NumofIntake.TheMonth eq 2>
#TheCount#
I want to see the details of 15 cfquery results when #TheCount# (in
this case, "15
link to a display page?
#theCount#
and in DisplayPage.cfm
SELECT * from Intake
WHERE datepart(blah blah) = #URL.mm#
- Original Message -
From: "Daniel Kang" <[EMAIL PROTECTED]>
To: "CF-Talk"
Sent: Saturday, March 19, 2005 12:43 PM
Subject: Re: cfq
On Wednesday 15 Aug 2007, [EMAIL PROTECTED] wrote:
> ALTER SESSION SET NLS_DATE_FORMAT = 'MMDD HH24:MI:SS';
>
> SELECT SYSDATE as theDate, startDate, TO_CHAR(startdate, 'MMDD
> HH24:MI:SS') as maskedDate
Data formating is not the job of the database.
Return a proper date, and form
I'm sorry I don't have a solution, but I'm really curious; why is the
column order important?
On 9/20/07, Todd Mathews <[EMAIL PROTECTED]> wrote:
> Does anyone know of a simple way to have the results of a CFQUERY return the
> results in the natural sql result order
I've run into very few instances where the alpha sorting of query columns
has been a bother. However, I just ran into one yesterday.
I wanted to use CFTABLE as a quick and easy way to display an unknown
recordset. Using COLUMNLIST from the CFQUERY result wouldn't work - I wanted
th
I need to write an sql statement within a cfquery tag that pulls from two
seperate datasources.
But it's coming back with "Invalid object name "
Below is the what I have written:
SELECT townid as tid, town as cityname from towns
where siteID = 1
union
select distinct city a
It all depends on what you want to do. For startersCached Queries are
good but you cannot use cfqueryparam, SPs can return multiple recordsets
which cfquery cannot.
In some cases it may be better to use cfquery and in some an SP.
-Original Message-
From: [EMAIL PROTECTED
Opinions?
Are cached queries as good as stored procedures?
Technically which are better?
Is it a significant difference?
Thanks
If you are just using stored procedures to cache the data, it is
probably a relatively even trade off.
But, of course a stored procedure can do a lot more then just
Thanks guys. I ijust found this article on Adobe.com that helped if anyone had
similar questions to my original questions.
http://www.adobe.com/devnet/coldfusion/articles/beg_storedproc.html
D
>Opinions?
>
>Are cached queries as good as stored procedures?
>Technically which are better?
>Is it
retrieve the data of course).
I'm thinking you might actually be asking about regular queries
however. Some years ago I did a test to see how much difference sp's
actually made. I constructed a couple of sp's to do lookups on large
tables, compared their execution time with
There are two reasons my organization encourages/forces all SQL to be in stored
procedures. And they don't directly touch on performance.
1. A belief that keeping SQL code in the database is of itself a good thing. By
keeping the database interaction in the database you make it easier for DBA's
ubject: RE: CFQUERY vs SQL Server Stored Procedures
There are two reasons my organization encourages/forces all SQL to be in
stored procedures. And they don't directly touch on performance.
1. A belief that keeping SQL code in the database is of itself a good thing.
By keeping the database int
t; Visit our website at http://www.reedexpo.com
>
> -Original Message-
> From: Ryan, Terrence
> To: CF-Talk
> Sent: Fri Mar 23 02:13:36 2007
> Subject: RE: CFQUERY vs SQL Server Stored Procedures
>
> There are two reasons my organization encourages/forces all SQL to be
, when I tried to insert a very big string in that
field (45536 character long). Although cfquery executed the UPDATE clause with
no exceptions, when I tried to retrieve a record (using cfquery again), I only
managed to get the first 32000 characters.
I run the update SQL string on the SQL Query
gabriel l smallman wrote:
> Hey all, anyone got a simple method to protect a var used in a where clause
> where we cannot use cfqueryparam?
>
> Example:
>
> OR P.Keywords LIKE '%#Url.SearchString#%'
Use cfqueryparam:
P.Keywords LIKE
Jochem
~~~
gabriel l smallman wrote:
> Hey all, anyone got a simple method to protect a var used in a where clause
> where we cannot use cfqueryparam?
Why can't you use cfqueryparam?
> OR P.Keywords LIKE '%#Url.SearchString#%'
OR P.KEYWORDS LIKE
- rick
~~
> Why can't you use cfqueryparam?
I have actually experienced this myself with the following, and only
on MS SQL Server. The same statement works great in mySQL, Access and
Oracle. In the code below, if we are running SQL Server
(localgrid.usedb=2) execution branches to bypass cfqueryparam.
I'v
Matt,
I use LIKE all the time in MS SQL with CFQueryParam...just to make
sure my head is screwed on straight, I just ran the following against
an nvarchar column:
where SomeColumn like
-joe
On Mon, 31 Jan 2005 11:17:27 -0800, Matt Robertson
<[EMAIL PROTECTED]> wrote:
> > Why can't y
in aswer to yuor question you can do something like
DECLARE @myvar varchar(100);
SET @myvar = '%#Url.SearchString#%'
Select ...
>From ...
Where p.Keywords LIKE @myvar
The syntax may not be 100% but I hope that gets the idea across...and
just to echo everyone else...why can't you use cfqueryPara
Joe,
This is what I get for pasting snippets without writing up the
background properly...
This was for an ntext field. Thats where this started worming its way
into my code. SQL Server was barfing on searches where I was
searching thru a page's contents as part of a global site search.
Can y
Realistically, coldfusion automatically escapes any single quotes
ANYWAY... so
FOO LIKE '%#url.somevar#%'
should be safe anyway, unless you're using PreservESingleQuotes somewhere.
Still... use cfqueryparam, it's good for you.
- Rick
~
>> why can't you use cfqueryParam???
Because the query may be called with the cachedwithin attribute which
doesn't play nice with queryparams. I haven't seen a easy work around for
this issue yet.
>> Realistically, coldfusion automatically escapes any single quotes
ANYWAY...
But if im not mist
emp_id=;drop table emp" (with the appropriate url
encoding.
But for strings...
select * from products where title like '%#url.criteria#%'
It's not really a problem because like I said, coldfusion automatically
escapes single quotes within variabl
>gabriel l smallman wrote:
>>
Realistically, coldfusion automatically escapes any single quotes
>>
>> But if im not mistaken(easily could be) someone might not need to be able to
>> stuff in single quotes to tamper? I think they need the semi colon and
>> parens to insert a sub query to blow
> I use val()
>
> select * from emp where emp_id=#val(url.emp_id)#
>
> Anything not numeric will be dropped. A totally non-numeric
> value will return 0.
>
> For dates I use ODBCDateFormat.
That's great for numbers, but what about strings?
Dave Watts, CTO, Fig Leaf Software
http://www.figleaf
> Because the query may be called with the cachedwithin
> attribute which doesn't play nice with queryparams. I haven't
> seen a easy work around for this issue yet.
You can cache your query within the Session, Application or Server scopes,
or you might be able to cache a query of that query us
> Because the query may be called with the cachedwithin attribute which
> doesn't play nice with queryparams. I haven't seen a easy work around
> for this issue yet.
You can cache your query within the Session, Application or Server scopes,
or you might be able to cache a query of that query usi
gabriel l smallman wrote:
>
> >> would the statement made by rick still hold true though. The
> attack would need to be able to close the single quotes to embed an attack.
And how hard is that exactly? Don't go and play 'I know more
about SQL then you do' with a hacker. You lose.
Jochem
> I have tried this but ran into casting issues. MX would make
> the wrong guess at the data type of the column.
In that case, I'd recommend that you just put the query objects within the
Session, Application or Server scopes as appropriate. If you're writing the
application yourself, this is usu
> > I use val()
>>
>> select * from emp where emp_id=#val(url.emp_id)#
>>
>> Anything not numeric will be dropped. A totally non-numeric
>> value will return 0.
>>
>> For dates I use ODBCDateFormat.
>
>That's great for numbers, but what about strings?
>
>Dave Watts, CTO, Fig Leaf Software
>htt
901 - 1000 of 1479 matches
Mail list logo
